Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ant-design/x

              main @ 065f0e0
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Cross-Site Scripting (XSS): 3 prior fixes. Scrutinize any change in this area.

packages/x-markdown/src/XMarkdown/core/Renderer.ts: most-fixed (3 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): The markdown rendering logic historically bypassed DOMPurify sanitization in non-browser or Server-Side Rendering (SSR) environments, or failed to sanitize output entirely before parsing it into React nodes, leading to high-severity XSS.

Unauthorized Code Execution: Workflows triggered by external pull requests possessed elevated GITHUB_TOKEN write privileges, exposing the repository to unauthorized modifications or secrets access from untrusted code.

Credential Leak: An active SiliconFlow API credential was inadvertently committed to public demo code, exposing downstream integrations to unauthorized access and resource abuse.